Russian Military Spy Software Is On Home Routers

The Russian military is inside hundreds of thousands of routers owned by Americans and others around the world, a top U.S. cybersecurity official said on Friday. The presence of Russian malware on the routers, first revealed in May, could enable the Kremlin to steal individuals’ data or enlist their devices in a massive attack intended to disrupt global economic activity or target institutions.

On May 27, Justice Department officials asked Americans to reboot their routers to stop the attack. Afterwards, the world largely forgot about it. That’s a mistake, said Rob Joyce, senior advisor to the director of the National Security Agency and the former White House cybersecurity coordinator.

“The Russian malware is still there,” said Joyce.

On May 8, cybersecurity company Talos observed a spike in mostly Ukrainian victims of a new malware attack. Dubbed VPN Filter, the malware used code similar to the BlackEnergy tool that Russian forces have used (in modified form) to attack Ukrainian infrastructure. The U.S. intelligence community believes the culprits are the hackers known as APT 28 or Fancy Bear, Russian military operatives who were behind information attacks against the Democratic National Committee, State Department, and others. The new malware, if activated, could allow the Russian military to peer into the online activities of hundreds of thousands of people.

“The Cisco-Talos reports on the incident estimated hundreds of thousands of devices affected worldwide,” Joyce said.

Specifically, the May 23 report said, at least 500,000 victims in up to 54 countries.

The malware executes in three stages, according to the Talos report. The first stage is akin to a tick burrowing into a victim’s skin, to “dig in” with its teeth by changing the infected devices’ non-volatile persistent memory, the portion of the memory that persists even after the machine is turned off. During this phase, the malware also establishes links to any servers it finds.

Stages two and three are about receiving and executing the orders. These could include: stealing traffic data from the victim (via port 80), launching “man in the middle” attacks, using the router as a platform to attack other computers as part of a botnet, or overwriting the memory on the router to render it unusable.

The U.S. government effort to stop the attack “was effective at knocking down their command and control. But — and this is a ‘but’ we haven’t seen talked about that much — there was a persistent ‘stage one’ on all of those routers,” said Joyce. “If it was at a stage-two or stage-three implant, it knocked it back to one, which was power- and reboot-persistent. At that point, we couldn’t call back out via those two methods to re-establish command and control,” he told the crowd.

Bottom line: “It’s still on those routers and if you know the wake-up knock you can go in, control those routers, and put a stage two or three back on them… What do you think the odds are that the actors in Russia who put those down have the addresses of the places where the put the malware? I think it’s pretty high,” he said.

What’s needed now, Joyce said, is for government, industry, and cybersecurity professionals to find a way to straightforwardly tell individuals how to detect the presence of the malware on their routers and then to restore the device to its trustworthy state. The government won’t be able to do that for them “because, again, these are consumer devices…That’s the sort of thing we’re up against.”

Joyce served as the head of the NSA’s elite tailored access operations division. In effect, he was the official who presided over the NSA’s most sophisticated hacking research before joining the White House as cybersecurity coordinator. In April, the White House announced that Joyce would leave that job to return to the NSA, where he currently serves as an advisor to the director, Army Gen. Paul Nakasone, who also heads the military’s U.S. Cyber Command.

He used the majority of his Friday talk at DEFCON to focus on China, Russia, Iran, and North Korea and their malicious behavior online.

Like other cybersecurity professionals, he said that North Korea’s malicious targeting of financial institutions, particularly South Korean e-currency exchanges, was likely to continue. He also said that he expected to see probing of newly deployed missile defense radars and batteries in the region, such as Terminal High Altitude Area Defense, or THAAD, in South Korea.

Iranian hackers also pose a threat, Joyce said, saying that the demise of the Iran nuclear deal hinted at more attacks to come.

“When bilateral relations between Iran and Saudi Arabia decreased, we think that was a major factor in that January 2017 data deletion attacks in Saudi,” he said, referring to an incident where Iran state-backed hackers attacked 15 Saudi government and media targets with malware that was strikingly similar to the 2012 ‘Shamoon’ malware that Iran deployed against Saudi oil interests. “As we move to a point where the U.S. has just re-imposed sanctions on Iran, there’s a lot of focus on, ‘How are they going to respond?’”

Defense One:

You Might Also Read:

Can Russian Hackers Be Stopped?

« Why Some Computer Viruses Refuse To Die
UK Police Fail To Take Digital Advantage »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Exodus Intelligence

Exodus Intelligence

Exodus Intelligence are an industry leading provider of exclusive zero-day vulnerability intelligence, exploits, defensive guidance, and vulnerability research trends.

IT Security Guru

IT Security Guru

IT Security Gurus publish daily breaking news. interviews with the key thinkers in IT security, videos and the top 10 stories as picked by our Editor.

Mnemonica

Mnemonica

Mnemonica specializes in providing data protection system, information security compliance solutions, cloud and managed services.

Repulsa

Repulsa

Repulsa provides state-of-the-art, patented, fast filtering with over 700 million malicious IP addresses and over 30 million categorized site listings updated daily.

IronNet Cybersecurity

IronNet Cybersecurity

IronNet’s product and services provide enterprise-wide security management and visibility of your network, users and assets.

Jenson Knight

Jenson Knight

Jenson Knight is a global cyber security, cloud and IT infrastructure staffing specialist.

Binary Defense

Binary Defense

Binary Defense protect businesses of all sizes through advanced cybersecurity solutions including Managed Detection and Response, Security Information and Event Management and Counterintelligence.

Tier One Technology Partners

Tier One Technology Partners

Tier One Technology Partners is an IT managed services provider that focuses on cybersecurity, cloud services, IT consulting, and infrastructure.

Sec-Ops

Sec-Ops

Sec-Ops is a forward thinking cyber security company, formed by a group of security enthusiasts with years of experience and backgrounds in the technology and the government industries.

Training.com.au

Training.com.au

Training.com.au is a comparison website through which those looking to learn about different aspects of cyber security can compare learning courses from training providers from across Australia.

IONOS

IONOS

IONOS is a leading provider of cloud infrastructure, cloud services, and hosting with more than 8.5 million customers contracts.

FTI Consulting

FTI Consulting

FTI Consulting is a global business advisory firm dedicated to helping organizations manage change, mitigate risk and resolve disputes.

B&L PC Solutions

B&L PC Solutions

B&L PC Solutions deliver top cyber security services on Long Island and New York city to protect businesses from evolving online threats.

Mobilen Communications

Mobilen Communications

Mobilen are dedicated to providing our customers with the highest level of secure data in transit and to bring privacy back to a mobile world.

ClearSale (CLSA3)

ClearSale (CLSA3)

Clearsale’s innovative fraud solutions combine advanced technology with a passionate team of seasoned experts that understand every client’s unique needs.

Sirar by STC

Sirar by STC

Sirar is an advanced technology and cybersecurity company established by STC, the MENA region’s ICT and digital services provider.